# CVE-2026-5523: Divi Engine Divi Form Builder account takeover via missing authorization

Source: https://junglewise.ai/threats/cve-2026-5523-divi-engine-divi-form-builder-account-takeover-via-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-5523 · Severity: high · CVSS 8.8 · Published 2026-07-09

The Divi Form Builder plugin for WordPress, which allows site owners to create custom contact and registration forms, contains a security flaw that allows unauthorized users to take over other accounts. By exploiting this vulnerability, a person with a basic user account can change the email address and password of any other user, including site administrators. This could lead to a total loss of control over the website and exposure of sensitive customer data.

Technologies: [Divi Engine Divi Form Builder](https://junglewise.ai/threats/technologies/divi-form-builder). Vendors: [Divi Engine](https://junglewise.ai/threats/vendors/divi-engine).

## Quick answers

**Is CVE-2026-5523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5523 being exploited in the wild.

**How severe is CVE-2026-5523?** High severity, with a CVSS score of 8.8, published 9 July 2026.

**Which products and versions are affected?** Divi Engine Divi Form Builder up to, and including, 5.1.8.

**Is there a fix for CVE-2026-5523?** A patch was published on 2026-05-24: Security hardening released in version 5.1.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5523 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5523?** Check whether you run Divi Engine Divi Form Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Divi Form Builder plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) and Missing Authorization flaw in versions up to 5.1.8. The root cause is located in the update_user() function, which accepts a user ID parameter from form submissions without verifying if the authenticated user has the necessary permissions to modify that specific account. Additionally, the handle_register_submission() function fails to validate permissions for the target user, only checking if a user is logged in. An authenticated attacker with subscriber-level permissions can exploit these flaws to change the email and password of any user, including administrators. A patch was released in version 5.1.9.

## Affected products

- Divi Engine Divi Form Builder up to, and including, 5.1.8

## Timeline

- 2026-05-24: patched: Security hardening released in version 5.1.9
- 2026-07-09: disclosed: CVE published to NVD

## References

- [https://diviengine.com/divi-form-builder-changelog/](https://diviengine.com/divi-form-builder-changelog/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/cb158acc-69d7-4a7d-b356-7de1f6b37019?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/cb158acc-69d7-4a7d-b356-7de1f6b37019?source=cve)

## Related threats

- [Divi Engine Divi Form Builder arbitrary file upload in do_image_upload](https://junglewise.ai/threats/cve-2026-5524-divi-engine-divi-form-builder-arbitrary-file-upload-in-do-image)
- [Divi Engine Divi Form Builder privilege escalation in registration forms](https://junglewise.ai/threats/cve-2026-5118-divi-engine-divi-form-builder-privilege-escalation-in-registration)